Fundamentals of Access Control and Network Defense Devices
頻出~47 min7 terms17 past questions
Goals of this unit
Explain access rights (settings for who may do what) separately from access control (the mechanism that checks those settings to let a request through or stop it).
Tell a firewall from a WAF by what each one protects and what information it decides by.
Distinguish an IDS from an IPS by whether the traffic is stopped after an attack is detected.
Access rights (アクセス権) define, for a resource such as a file or database, who may perform which operations.
User \ Operation
View
Edit
Delete
General affairs staff
○
○
×
General affairs manager
○
○
○
Other departments
○
×
×
Outsiders
×
×
×
Permissions can be set separately for each kind of operation, such as view, edit and delete, and granted either to individual users or to whole groups such as departments. As a rule, people get only the rights their work needs, which is the principle of least privilege (最小権限). Excess rights widen the damage when someone makes a mistake or an account is hijacked.
AnalogyIt is like staff ID cards that open different doors for different people. Even within one company, some cards open the storeroom and some do not.
How to rememberIn “access right”, right means an entitlement, not “correct”: picture a list of what each person is entitled to do.
Exam points
ExamSetting access rights properly guards against information leaks and tampering by people without permission. Threats that have nothing to do with permissions need other countermeasures alongside it.
ExamWhen rights are set for both groups and individuals, first apply the priority rule stated in the question to fix each person's effective setting, then count who is allowed each operation.
ExamUnder least privilege, logging in with administrator rights for everyday work is a habit that raises risk.
Access control (アクセス制御) confirms who is making a request, checks it against the configured access rights, and lets through only the permitted operations while refusing the rest.
Request
Authentication (who are you?)
Authorization (check rights)
Allow or deny
If they do, the operation is allowed; if not, it is refused.
4 / 4
The step that confirms identity is authentication (認証), and the step that decides whether the requested operation is allowed by that person's access rights is authorization (認可); access control performs the two in that order. If requests that match no rule are denied by default, a missing entry fails safe. Physical entry control, which admits people to rooms or keeps them out using IC cards or biometrics, applies the same idea of access control.
AnalogyThink of the front desk at a members-only gym. Staff check your membership card, see whether your plan includes the pool, and only then decide whether to let you in.
How to rememberIf access rights are the guest list, access control is the door attendant who checks it.
Exam points
ExamAllowing use only to people confirmed as genuine against registered information is an example of access control carried out by a system. Keep it separate from the task of granting rights itself.
ExamTo protect the confidentiality (機密性) of a file that only a few people may read, choose access control. Signatures and time proofs check for tampering or prove when something was created, which is a different purpose.
ExamOn a wireless LAN, registering each device's unique number (its MAC address) and refusing connections from any other device is also a form of access control.
Callback (コールバック) is a method in which the system ends an incoming connection over a telephone line or similar and then itself dials a registered number to connect.
User asks to connect
System hangs up
System dials registered number
Connection established
Communication starts only if the terminal at the registered location answers.
4 / 4
Because the system only calls numbers registered in advance, a third party who has stolen an ID and password still cannot complete a connection from somewhere else. Since the system places the call, it also pays the call charges.
AnalogyIt is like ignoring calls from unknown numbers and instead ringing back a number in your contacts to ask what they wanted.
How to rememberThe name is the everyday phrase, as in “I'll call you back.”
Exam points
Mix-upAn ID and password confirm identity by what a person knows, while callback narrows down users by where they connect from. The two can also be combined.
A firewall (ファイアウォール) sits mainly at the boundary between an organization's network and the outside, or at a device's entrance, passing only traffic that matches set rules and blocking everything else.
← Scroll the figure sideways →
It decides mainly by the source and destination addresses and the port numbers (numbers that identify the type of service) of each communication. Firewalls can divide a network to create an intermediate zone, the DMZ, that holds only the servers made public to the outside. Software installed on each PC to protect that machine is called a personal firewall (パーソナルファイアウォール).
AnalogyLike the auto-locking front door of an apartment block. Residents and the visitors they buzz in get through; everyone else stops at the door.
How to rememberIn a building, a fire wall stops a fire spreading from one section to the next, and the network version takes its name from it.
Exam points
ExamThe mechanism that stops unauthorized access from outside at the boundary between the internal and external networks is a firewall. A DNS server resolves names and a router chooses routes, so their roles differ.
ExamA firewall's job is sorting traffic at the network boundary, and the DMZ is created by that same division. Controlling who enters a room is the job of a different mechanism.
ExamWhen a PC connects directly to an outside network, install a personal firewall on the PC itself to block unauthorized connections. If the PC itself is stolen, disk encryption is what protects against information leaks.
A WAF (Web Application Firewall) inspects the content of requests reaching a web application and stops attacks that exploit its weaknesses.
Attacks that slip malicious commands into an input field arrive by the same route as normal traffic, so addresses and port numbers alone can hardly tell them apart. A WAF compares the content of each request with known attack patterns and keeps such attacks out. It is used on websites that accept user input, such as sign-up and search forms.
AnalogyLike an inspector who takes parcels that have already passed the gate and opens each box to check what is inside, not just the address.
How to rememberIt has Firewall in its name, but it reads what a request says, not where it is going. The W at the front stands for the Web, the thing it guards.
Exam points
ExamA WAF defends against attacks aimed at vulnerabilities (脆弱性), the weak spots in how a web application is built, and spots suspicious access. It is not the same as mechanisms that create secure channels or stop data from being taken out.
Mix-upA firewall decides mainly by address and port number, whereas a WAF decides by what the request contains. A WAF does not replace a firewall; the two are used together in layers.
An IDS (intrusion detection system) watches networks and servers and spots and reports signs of unauthorized intrusion or attack.
Monitor traffic
Detect suspicious activity
Alert administrator
Administrator responds
Actions such as cutting off the traffic are taken by the administrator who received the alert.
4 / 4
An IDS handles finding and reporting, and does not stop the traffic itself. Because it watches traffic and devices separately from the firewall that filters at the boundary, it can also notice attacks that got past the firewall and suspicious activity from inside. It can monitor either the traffic on a network or the activity on a server.
AnalogyLike a burglar alarm at home. It sounds when a window is forced open, but it does not push the intruder back out.
How to rememberD is for Detection: its job ends once the problem is found.
Exam points
ExamThe deciding feature of an IDS is that it watches, finds and reports to an administrator; stopping traffic is not part of it. Translating names into addresses and synchronizing clocks are jobs of other mechanisms.
ExamThe mechanism that checks a PC used outside the company for infection before it joins the internal network is a quarantine network (検疫ネットワーク), not an IDS.
An IPS (intrusion prevention system) spots signs of attack just as an IDS does, and then automatically blocks that traffic.
Monitor traffic
Detect suspicious activity
Block automatically
Limit damage
The attack is stopped before it reaches deeper inside, so the damage is less likely to spread.
4 / 4
An IPS sits in the path of traffic and stops anything it judges to be an attack on the spot, so it limits damage without waiting for a person to act. On the other hand, if it mistakes normal traffic for an attack, it also blocks traffic the business needs.
AnalogyLike a shop security system that drops the shutter automatically when it senses a break-in. It does more than notice: it seals the entrance there and then.
How to rememberP is for Prevention. IDS and IPS differ by one letter, D versus P, and that letter tells you whether it reports or stops.
Exam points
Mix-upThe difference from an IDS lies in what happens after detection. An IDS only alerts the administrator, while an IPS stops the traffic automatically.
IDS vs. IPS
Aspect
IDS
IPS
Detects attacks
Yes
Yes
Key differenceAfter detection
Alerts the administrator (traffic keeps flowing)
Blocks that traffic automatically
Effect of false alarms
More unnecessary alerts
Even normal traffic is stopped
Key points
Access rights set who may do what; access control follows them, authenticating and authorizing users and refusing anything not permitted.
Grant only the rights a job needs (least privilege). Proper rights settings prevent information leaks and tampering.
Callback limits where connections can come from by dialing back a registered number.
A firewall sorts traffic at the boundary mainly by address and port number; a WAF goes further and inspects the content of requests to web applications.
An IDS finds attacks and reports them; an IPS goes on to automatically block the detected traffic.